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DETAILED ACTION 

This Office Action is responsive to reply filed on April 26, 2007. 
Response to Arguments 
1 . Applicant's arguments, filed 4/16/2007 with respect to declaration of common 
ownership have been fully considered and are persuasive. The Hellerstein et al (US 
2002/0073195) has been withdrawn. 

Response to Arguments 

With regards to the Applicant's remarks filed on April 26, 2007: 

Regarding the rejection of the claims 1-3 and 15-18 and 19 Applicant's 
arguments have been considered and are deemed persuasive. However, upon further 
consideration, new grounds of rejection are made. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-3 and 15-18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Cookmeyer et al (US 6,529,954) in view of Tenney et al (US 6,944,584 B1) 
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Regarding claim 1, Cookmeyer teaches apparatus for providing decision support 
to an analyst in accordance with an event management system which manages a 
network with one or more computing devices, the apparatus comprising: at least one 
processor operative to perform (Cookmeyer, col. 4, line 9-11): 

analysis of data representing past events associated with the network of 
computing devices being managed by the event management system, the automated 
analysis comprising generation of one or more visualizations of one or more portions of 
the past event data and discovery of one or more patterns in the past event data 
(Cookmeyer, col. 3, 1.17-38, in which a knowledge based expert analysis corresponds to 
a automated analysis system) and automated rule management comprising 
construction and validation of one or more rules formed in accordance with the analysis 
of the past event data, wherein one or more rules are constructed and validated based 
directly on at least a portion of the one or more visualization generated from the 
corresponding analysis of the one or more portion of the past event data and the 
discovery of at least a portion of the one or more patterns in the past event data 
(Cookmeyer, Fig.9, col.3, 1.17-20, 1.32-38, co1.4, 1.60, col.5, 1.58-67, and co1.21, 
1.51-52, col. 22, 1.13-33); and memory, coupled to the at least one processor, which 
stores at least a portion of results associated with the automated event analysis and 
rule management operations (Cookmeyer, co1.7, 1.15-24) 

Cookmeyer does not disclose that rule management and analysis of the data can 
be done off-line (before putting them on the network interface card). 
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Tenny shows all the steps in the claim (rule management and analysis of the 
data) can be done off-line (Col 5, line 21-32) 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the method of Cookmeyer by providing an off-line 
analysis as taught by Tenny in order to secure rule management and analysis of the 
data and prevent other user to monitor the analysis. 

Regarding claim 2, Cookmeyer further discloses the apparatus of claim 1 , 
Wherein, the past event data is obtained from an event database and the one or more 
rules are provided to a rule database, the event database and the rule database being 
associated with an execution system of the event management system. 
(Cookmeyer, Col 25, line 37-43). 

Regarding claim 3, Cookmeyer further discloses the apparatus of claim 2, 
Wherein, generation of the one or more visualizations of the one or more portions of the 
past event data further comprises: 

selecting a subset of the past event data from the event database(Cookmeyer, Col. 22, I. 
13-33); generating a visualization of the subset of past event data using a visualization 
tool (Cookmeyer, Col.7 ( line 25-37); the analyst reviewing the visualization to determine 
whether there are any groupings of events that are of interest presented therein 
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(Cookmeyer, Col 22, line 34-38); and performing an appropriate action when an event 
grouping of interest is found (Cookmeyer, Col 22, line 41-47), 

Regarding claims 15-16 have similar limitations as claims 1-2, the difference is 
one is claimed for apparatus, and the other is claimed for means function. Therefore, 
claims 15-16 are rejected for the same reasons set forth in the rejection of claims 1-2. 

Regarding claims 17-18 have similar limitations as claims 1-2, the difference is 
one is claimed for apparatus, and the other is claimed for event support system. 
Therefore, claims 17-18 are rejected for the same reasons set forth in the rejection of 
claims 1-2. 

Claims 4-6 are rejected under 35 U.S.C 103(a) as being unpatentable over 
Cookmeyer et al (US 6,529,954) in view of Tenney et al ( US 6,944,584 B1) further in 
view of Ma et al (Publication, Maet al., Mining Event Data for Actionable Patterns, IBM 
T.J. Watson Research Center, NY, December 2000). 

Regarding claim 4, Cookmeyer teaches features of the invention substantially as 
claimed, discovery of the one or more patterns in the past event data, selecting a subset 
of the past event data from the event database (Cookmeyer, Col 22, line 50-63); 
generating a visualization of the one or more patterns using a visualization tool 
(Cookmeyer, Col 22, line 61-63, statistics corresponds to the pattern). the analyst 
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reviewing the visualization to determine whether there are any patterns of interest 
presented therein (Cookmeyer, Col. 23, Iine1-10); and performing an appropriate 
action when a pattern of interest is found (Cookmeyer, Col.23, line 28-33). Although the 
above mentioned prior art teaches event analysis using visualization, it does not include 
the mining algorithm. 

However, Ma teaches mining the subset of the past event data 
to discover the one or more patterns using a mining tool (Ma, page 4, section 2, 
algorithm 1 ). 

Because knowing the offline event analysis of event management (Ma, fig. 1 ) uses 
event flow data to discover one or more patterns using a mining tool, (see Ma, page 5, 
5th paragraph), which can be used to modify the select the data source as an off-line 
analysis of a capture data file and set-up software filter, (see Cookmeyer, Col. 21 , line 
38-46). It would have been obvious to one ordinary skilled in the art at the time the 
invention was made to incorporate the teaching of Howard for data mining algorithm as 
is well-known in the art to discovery patterns of interest with Cookmeyer's problem filter 
(discovery) structure. Therefore, the claimed invention would have been obvious to one 
of ordinary skill in the art at the time of the invention. 

Regarding claim 5, Ma further discloses the apparatus of claim 2, 
wherein validation of the one or more rules farther comprises: selecting a subset of the 
past event data from the event database (Ma, page 4, 4th paragraph); finding one or 
more instances of patterns expressed in terms of left-hand sides of rules (Ma, page 2, 
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2nd , and 3rd paragraph); generating a visualization of the one or more pattern 
instances using a visualization tool (Ma, page 2, 3rd, and 4th paragraphs); analyzing the 
left-hand sides of rules using a rule validation tool(Ma, page 1 , fig. 1 ); displaying results 
of the analysis operation (Ma, fig. 3); the analyst assessing analysis results (Ma, page 
3, 1st paragraph); and marking the rules as one of validated and not validated based on 
the assessment by the analyst (Ma, page 9, fig, 6). 

Regarding claim 6, Ma further discloses the apparatus of claim 2, wherein 
construction of the one or more rules further comprises: 

selecting a subset of the past event data from the event database (Ma, page 6, 2nd 
paragraph); mining the subset of the past event data to discover the one or more 
patterns using a mining tool (Ma, page 6, 3rd paragraph); assessing significance of the 
one or more patterns using a visualization tool (Ma, page 2, 3rd paragraph); 
constructing the one or more rules from a selected subset of the one or more patterns 
using a rule construction tool (Ma, page 3, 3rd paragraph); and writing the one or more 
rules in the rule database (Ma, page 10, 1st paragragh) 

Regarding claims 7-12 have similar limitations as claims 1-6, the difference is 
one is claimed for apparatus, and the other is claimed for method. 
Therefore, claims 7-12 are rejected for the same reasons set forth in the rejection of 
claims 1-6. 
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Regarding claims 13-14 have similar limitations as claims 7-8, the difference is 
one is claimed for method, and the other is claimed for manufacture. 
Therefore, claims 13-14 are rejected for the same reasons set forth in the rejection of 
claims 7-8. 

Claim 19 is rejected under 35 U.S.C 103(a) as being unpatentable over Ma et al 
(Publication, Maet al., Mining Event Data for Actionable Patterns, IBM T.J. Watson 
Research Center, NY, December 2000). In view of Tenney et al ( US 6,944,584 B1) 

Regarding claim 19, Ma discloses an event management decision support 
system for providing decision support to an event management system which manages 
a network with one or more computing devices, the system comprising (Ma, fig. 1): an 
event analysis module, further comprising an event mining module and an event 
visualization module, wherein the event mining module discovers patterns in event data, 
and wherein the event visualization module provides a mechanism for visualizing at 
least a result of a pattern discovery and a rule analysis (Ma, fig. 1 , element block of 
Event Analyzer); and a rule management module, further comprising a rule validation 
module and a rule construction module (Ma, fig. 1, element box of Rule Generator), 
wherein the rule validation module maintains consistency of at least a rule with the 
event data (Ma, page 8, ninth, and tenth paragraphs), and wherein the rule 
construction module provides a mechanism for constructing one or more rules based on 
event patterns mined by the event mining module; wherein the one or more rules are 
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constructed by the rule construction module and validated by he event visualization 
module from the corresponding analysis of one or more portions of the event data and 
the discovery of at least a portion of the one or more patterns in the event data by the 
event mining module (Ma, page 2, 3r~ and 4th paragraph, page 3, 3rd paragraph). 

MA does not disclose that construction module and visualization module can be 
done off-line (before putting them on the network interface card). 

Tenny shows all the steps in the claim (construction module and visualization 
module comprising Software) can be done off-line (Col 5, line 21-32) 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to modify the method of MA by providing an off-line analysis as 
taught by Tenny in order to secure rule management and analysis of the data and 
prevent other user to monitor the analysis. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ali Shayanfar whose telephone number is 571-272- 
9739. The examiner can normally be reached on M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell can be reached on 571-272-3868. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Ali Shayanfar 




ANDREW CALDWELL 
SUPERVISORY PATENT EXAMINER 



